# List of hostnames for use with Snort
#
# For more information about this list, see: https://pgl.yoyo.org/adservers/
# ----
# last updated:   Sat, 18 Nov 2017 20:57:32 GMT
# entries:        2477
# format:         snort (snort -- for use with Snort)
# credits:        Peter Lowe - pgl@yoyo.org - https://pgl.yoyo.org/ - https://twitter.com/pgl
# this URL:       https://pgl.yoyo.org/as/serverlist.php?hostformat=snort;showintro=0
# other formats:  https://pgl.yoyo.org/adservers/formats.php
# policy:         https://pgl.yoyo.org/adservers/policy.php
#
# start date:    Mon, 24 Nov 1997 00:00:00
alert tcp  any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"101order.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"123freeavatars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"180hits.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"207.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"24log.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"24log.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"2mdn.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"2o7.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"360yield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"4affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"51yes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"600z.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"777partner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"77tracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"7bpeople.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"7search.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"99count.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a-counter.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.0day.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.aproductmsg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.consumer.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.sakh.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a32.g.a.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aaddzz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abandonedclover.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abc-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abruptroad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"absoluteclickscom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ac.rnm.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actuallysheep.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"acuityads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"acuty1adsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-balancer.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-balancer.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-center.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-pay.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-server.gulasidorna.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-serverparc.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-souk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-space.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-tech.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.100.tbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.abcnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.abctv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.admitad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.afy11.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.allstar.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.amgdgt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.auditude.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.bizo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.caradisiac.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.cgi.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.clix.pt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.digitallook.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.directrev.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.doctissimo.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.domainfactory.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.e-kolay.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.eurosport.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.f1cd.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.flurry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.foxnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.freecity.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.gate24.ch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.globe7.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.grafika.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.hbv.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.hodomobile.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.hyena.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.ilove.ch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.infoseek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.jamba.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.jamster.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.liveinternet.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.lupa.cz"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"ad.media-servers.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.mediastorm.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.mgd.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.musicmatch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.nachtagenten.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.nwt.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.onad.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.profiwin.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.rambler.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.reunion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.sensismediasmart.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.seznam.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.slutload.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.tbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.technoratimedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.turn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.tv2.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.way.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.yourmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.zanox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad0.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad01.mediacorpsingapore.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad1.emediate.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad1.emule-project.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad1.kde.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad1.pamedia.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.linxcz.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.lupa.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2flash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad3.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad3.pamedia.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad3.xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adaction.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adap.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adapt.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbard.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adblade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adblockanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adboost.de.vu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adboost.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbunker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbutler.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbuyer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbuyer3.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcast.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcell.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcenter.mdf.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcentriconline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcept.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adclient.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexchangegate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexchangeprediction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexcite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexpose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adext.inkclub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adfarm.mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adforce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adform.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adform.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adformdsp.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adgoto.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adgridwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhese.be"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhese.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.carsoup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.homestore.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.omroepzeeland.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimg.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimg.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimg.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimpact.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adincube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adition.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adition.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adizio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjug.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjuggler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjustnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"adk2ads.tictacti.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adland.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlantic.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adledge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adloox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlooxtracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlure.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admagnet.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adman.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adman.in.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adman.otenet.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admanagement.ch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admanager.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admanager.carsoup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admarvel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admax.nexage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admerize.be"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admeta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admized.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admob.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admonitor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admotion.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet-media.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.worldreviewer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnetinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnetworkperformance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnews.maddog2000.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnotch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnxs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adocean.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adoperator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpenguin.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpepper.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adperium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpia.vn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adplus.co.id"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adplxmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adprofile.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adprojekt.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrazzi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adreclaim.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrecreate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adremedy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adres.internet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrevolver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adriver.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrolays.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrotate.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrotator.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.4tube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.activestate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adfox.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.administrator.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adshareware.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adultswim.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.advance.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ak.facebook.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.allvatar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.alt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.amdmb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.amigos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.aol.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.aol.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.apn.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.as4x.tmcs.ticketmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.asia1.com.sg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ask.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.batpmturner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.beenetworks.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.belointeractive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.berlinonline.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.betanews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.betfair.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.betfair.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bigchurch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bloomberg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bluelithium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bluemountain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bluesq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bonniercorp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.boylesports.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.businessweek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.casinocity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cbc.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cc"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cgnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.contactmusic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.contentabc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.crakmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.creativematch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cricbuzz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.dada.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.datinggold.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.datingyes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.dazoot.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.detelefoongids.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.domain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.eagletribune.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.eatinparis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.edbindex.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.egrana.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.einmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.electrocelt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.elitetrader.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.emirates.net.ae"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.eu.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.expat-blog.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.expedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.factorymedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.faxo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ferianc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.flooble.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.footymad.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.forbes.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.forium.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fotosidan.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.foxkidseurope.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.foxnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.freecity.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gamershell.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gamigo.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gaming-universe.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.geekswithblogs.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.glispa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gradfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.grindinggears.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.groundspeak.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gsmexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.guru3d.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hardwaresecrets.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.harpers.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hbv.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.heias.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hideyourarms.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.horsehero.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.horyzon-media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.iafrica.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ibryte.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.indiatimes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.infi.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.internic.co.il"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.isoftmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.itv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.iwon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.jewishfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.jiwire.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.jobsite.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.jpost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.justhungry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kaktuz.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kelbymediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kinobox.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kinxxx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kompass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.krawall.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.lesbianpersonals.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.linkedin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.linuxfoundation.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.linuxjournal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.linuxsecurity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.livenation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.massinfra.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.medienhaus.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mmania.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.moceanads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.motor-forum.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.motormedia.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.multimania.lycos.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nationalgeographic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ncm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.netmechanic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.networksolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newdream.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newsint.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ninemsn.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nj.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nordichardware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nordichardware.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nyx.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nzcity.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.okcimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.olivebrandresponse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.optusnet.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.outpersonals.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pennet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.penny-arcade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.planet.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pni.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pof.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.powweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.primissima.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.printscr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.program3.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.psd2html.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pushplay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.rcs.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.recoletos.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.resoom.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.returnpath.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.satyamonline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.savannahnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.saymedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.scifi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.servebom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sexinyourcity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sift.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.silverdisc.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.slim.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sptimes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.stackoverflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sun.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.t-online.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tahono.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.techtv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.themovienation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.thestar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.totallyfreestuff.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.trinitymirror.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.spray.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.twitter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.uknetguide.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ultimate-guitar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.uncrate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.verticalresponse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.vgchartz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.videobash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.waps.cn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wapx.cn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.web.aol.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.web.cs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.webmasterpoint.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.whoishostingthis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wiezoekje.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wineenthusiast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wwe.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.xhamster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.xtra.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.y-0.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yldmgrimg.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.youtube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.zdnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ztod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads03.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.mediacapital.pt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.rne.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads10.speedbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads180.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.contentabc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.net-communities.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.oneplace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.xnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2004.treiberupdate.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads3.contentabc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads3.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads3.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads4.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads4.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads4.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads5.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads6.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsafeprotected.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsby.bidtheatre.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscale.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscience.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsend.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserv.evo-x.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserv.gamezone.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserv.iafrica.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserve.ams.rhythmxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.43plc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.aidameter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.aol.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.betandwin.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.break-even.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.cams.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.finditquick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.flossiemediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.freecity.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.hardsextube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.hardwareanalysis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.html.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.hwupgrade.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.irishwebmasterforum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.janes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.news.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.ngz-network.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.omroepzeeland.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.portalofevil.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.portugalmail.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.portugalmail.pt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.sciflicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.sharewareonline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.spankaway.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.theonering.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.viagogo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.virginmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver1.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver1.ogilvy-interactive.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver2.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserverplus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserving.unibet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adservinginternational.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adshost1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adside.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsk2.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adskape.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmart.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmogo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsnative.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsoldier.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsonar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adspace.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adspeed.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adspirit.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsremote.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrevenue.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.eacdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.iol.co.za"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrvr.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsupply.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adswizz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsymptotic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsys.townnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsystem.simplemachines.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtechus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtegrity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adthis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtoll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtrace.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtrading.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtriplex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.cooperhosting.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.hwupgrade.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.livedoor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.nexthardware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.wp.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.yo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advert.bayarea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advert.dyna.ultraweb.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adverticum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertiseireland.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertiserurl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertisespace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertising.guildlaunch.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertisingtag.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertpro.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertpro.ya.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adverts.carltononline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertstream.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advfromnwl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advideo.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adview.ppro.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advisormedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adwareremovergold.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adwhirl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adwitserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adworx.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adworx.be"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adworx.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adx.allstar.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adxpansion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adxprts.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adxvalue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adyea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adz2you.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzbazar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzerk.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzerk.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzones.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"af-ad.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affbuzzads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affili.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.doubleyourdating.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.gamestop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.mercola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.mogs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.offgamers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.viator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatefuel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatefuture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.allposters.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.babylon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.internationaljock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.streamray.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.thinkhost.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.thrixxx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.ultrahosting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatetracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatetracking.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatewindow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliation-france.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"afftracking.justanswer.com"; classtype:trojan-activity; priority:1;)
alert tcp 52.85.62.27 any $HOME_NET any (msg:"agreemand.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ahalogy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aidu-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aim4media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aistat.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aktrack.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alenty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alipromo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alladvantage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"allosponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"amazingcounters.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"amazon-adsystem.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ambitiousagreement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"americash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"an.tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"anahtars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.adpost.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"anm.intelli-direct.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"annonser.dagbladet.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"anxiousapples.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"app.adblockhyper.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"appsflyer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"apture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"arcadebanners.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ard.xxxblackbook.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"are-ter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"as.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"as1.advfn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"at-adserver.alltop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"atdmt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"auctionads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audience2media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"auto-bannertausch.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"autohits.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avpa.javalobby.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avres.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avsads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avzadsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"awempire.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"b-1st.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"b.aol.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"b.engadget.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"b0b1o.bid"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ba.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"babs.tv2.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banik.redigy.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner-exchange-24.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.ad.nu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.ambercoastcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.casino.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.casinodelrio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.cotedazurpalace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.coza.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.elisa.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.eurogrand.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.goldenpalace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.inyourpocket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.linux.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.media-system.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.nixnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.noblepoker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.penguin.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.rbc.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.relcom.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.titan-dsl.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.vadian.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.wirenode.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannercommunity.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerconnect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerexchange.cjb.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannergrabber.internet.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerhost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerlandia.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannermall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannermarkt.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.amigos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.audioholics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.cams.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.czi.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.direction-x.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.easydns.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.getiton.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.isoftmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.sys-con.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.thomsonlocal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.wunderground.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannersng.yell.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannertesting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannery.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bans.adserver.co.il"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"barnesandnoble.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"basebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"baskettexture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bawdybeast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bbelements.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beamincrease.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beamkite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"begun.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"belstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"belstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"berp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"best-pr.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"best-top.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bestsearch.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bhclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidswitch.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidtrk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidvertiser.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"billboard.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bitads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bitmedianetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bizad.nikkeibp.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bizographics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blingbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogherads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogrush.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogtoplist.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blueadvertise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bluelithium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bluewhaleweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bm.annonce.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boersego-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boilingbeetle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boldchat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boom.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boomads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boost-my-pr.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bpath.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brandreachsys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brassrule.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brightinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"british-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"broadboundary.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bttrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"budsinc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bullseye.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"buyhitscheap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"buzzonclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bvalphaserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"c1.nowlinux.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"c1exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"calmfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"campaign.bharatmatrimony.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"caniamedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carambo.la"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carbonads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carbonads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casalemedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cash4popup.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashcrate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashfiesta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashlayer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinogames.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cbmall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.freefarcy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.segment.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"centerpointmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ceskydomov.alias.ngs.modry.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cetrk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cgicounter.puretec.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ch.questionmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chameleon.ad"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chart.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chartbeat.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"checkm8.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"checkstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cherrythread.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chestionar.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chiefcurrent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chinchickens.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cityads.telus.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cjbmanagement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cjlog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"class-act-clicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.absoluteagency.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.kmindex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click2paid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickability.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickagents.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickbrokers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickcompare.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickdensity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickhype.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickmedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickonometrics.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicks.mods.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktag.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktrace.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktrack.ziyu.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktracks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktrade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickzxc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicmanager.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clientmetrics-pa.googleapis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clients.tbo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clikerz.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cliksolution.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clixgalore.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clk.konflab.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clkads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clkrev.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cluster.adultworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clustrmaps.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cnomy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cnt.spbland.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cnt1.pocitadlo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"code-server.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"coinhive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"comclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"commandwalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"commindo-media-ressourcen.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"concernrain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"confirmed-profits.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"consciouscabbage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"contaxe.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"content.acc-hd.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"content.ad"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"conversantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"conversionruler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"copperchickens.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"copycarpenter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"copyrightaccesscontrols.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"coremetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"count.rbc.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"count.west263.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.cnw.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.fateback.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.mirohost.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.mojgorod.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.nowlinux.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.search.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.snackly.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.sparklit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counters.honesty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counting.kmindex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counts.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"coupling-media.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cp.abbp1.pw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpays.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpmaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crakmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"craktraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crawlability.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crawlclocks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crazypopups.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"creafi-online-media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"creatives.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"creatives.livejasmin.com"; classtype:trojan-activity; priority:1;)
alert tcp 52.85.69.106 any $HOME_NET any (msg:"credishe.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"criteo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"critictruck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crownclam.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ctnetwork.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"curtaincows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"customad.cnn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cutecushion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cybermonitor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"d.adroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dakic-ia-300.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"danban.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dapper.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"datashreddergold.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dbbsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"debtbusterloans.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decisiveducks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decknetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"delightdriving.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deloton.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"demandbase.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"demdex.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dialerporn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dianomi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"differentdesk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"digital-ads.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"digitalmerkat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"direct-xxx-access.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directivepub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"displayadsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dk4ywix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dmtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dmtracking.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dmtracking2.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dnads.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"docksalmon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"domainsponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"domdex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubleclick.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doublepimp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubtfulrainstorm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dragzebra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"drumcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dynamic.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-adimages.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-bannerx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-debtconsolidation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-m.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-n-t-e-r-n-e-x.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-planning.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e.kde.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eadexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eas.almamedia.fi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ebayadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ebocornac.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eclick.vn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"effectivemeasure.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"effectivemeasure.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elasticchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elephantqueue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elitedollars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emarketer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emediate.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emediate.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enoratraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eqads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"esellerate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"estat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"etahub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"etargetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"etracker.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eu1.madsone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eur.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"euroclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eusta.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"evergage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"evidencecleanergold.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exchange.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exclusivebrass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exelator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exit76.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exoclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exogripper.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"experteerads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exponential.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"express-submit.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"extractorandburner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"extreme-dm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"extremetracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyeota.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyereturn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyeviewads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ezula.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"f5biz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fast-adv.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fastclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fastclick.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fc.webmasterpro.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"feedjit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ffxcam.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"findcommerce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fineclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"first.nova.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flavordecision.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flexbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"floodprincipal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flurry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fonecta.leiki.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"foo.cosmocode.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fpctraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fpctraffic2.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fqtag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fragmentserv.iac-online.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"free-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freeonlineusers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"functionalclam.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"funklicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"funpageexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fusionads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fusionquest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"futuristicfairies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fuzzyflavor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ga87z2o.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"galaxien.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"game-advertising-online.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gamehouse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gamesites100.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gamesitestop100.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gemius.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"geo.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"geobanner.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"geovisite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"getclicky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"giddycoat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"globalismedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"globaltakeoff.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"globe7.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"globus-inter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gmads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"googleadservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gorgeousground.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gp.dejanews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gpr.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"grafstat.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"grapeshot.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"greetzebra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"greystripe.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gtop100.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"guardedgovernor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"guitarbelieve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gunggo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"harrenmedianetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"havamedia.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"heias.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hellobar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hentaicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hexusads.fluent.ltd.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"heyos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hgads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hidden.gogoceleb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hilariouszinc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hit-parade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hit.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitbox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitcents.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitiz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitometer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.europuls.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.puls.lv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.theguardian.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits4me.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits4pay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"homepageking.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hostedads.realitykings.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hotjar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hotkeys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hotrank.com.tw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hs-analytics.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"htmlhubing.xyz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hyperbanner.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hypertracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"i-clicks.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"i.xx.openx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"i1img.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"i1media.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ia.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iadnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iasds01.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iconadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"idcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"identads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"idregie.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"idtargeting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ientrymail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iesnare.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ilbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ilead.itrack.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"illustriousoatmeal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imageads.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"images-pw.secureserver.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"images.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imarketservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"img.prohardver.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imgpromo.easyrencontre.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imonitor.nethost.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imprese.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"impressionz.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inboxdollars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"incrediblesugar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"indexstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"indexww.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inetlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"infinityads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"information.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inmobi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"innovid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inringtone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"insightexpressai.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inspectorclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"instinctiveads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intellitxt.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"interactive.forthnet.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"interstat.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ioam.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ip.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ireklama.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"itop.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ivwbox.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ivykiosk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jewelcheese.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jinkads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jsecoin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"juicyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jumptap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"justrelevant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"justwebads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"k.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kargo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"keymedia.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kindads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kniverto.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"komoona.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kompasads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kt-g.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ktu.sv2.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"launchbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"layer-ad.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lead-analytics.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadzupc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"levelrate.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liftdna.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ligatus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ligatus.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lightningcast.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lijit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"limpingline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link-booster.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkadd.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkstorms.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liveadexchanger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liveintent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liverail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lizardslaugh.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"log.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"logger.snackly.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lopsidedspoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"loudloss.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lp3tdqle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lumpyleaf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lzjl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"m1.webstats4u.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"m4n.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mackeeperapp.mackeeper.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madclient.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mads.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marchex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"market-buster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.hearstmagazines.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mas.sector.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mastermind.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"matchcows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mathtag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"max.i12.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"maximumcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mbs.megaroticlive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mbuyu.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mdotm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media-servers.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media.funpic.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediabridge.cc"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediamath.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaplazza.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediascale.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaserver.bwinpartypartners.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediatext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediavoice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaz.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"medleyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"medyanetads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.cnn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.ctv.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.govexec.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mgid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"misstrends.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mixedreading.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mixtraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mjxads.internet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ml314.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mlm.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mmismm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mmtro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moatads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mobclix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mocean.mobi"; classtype:trojan-activity; priority:1;)
alert tcp monetate.net any $HOME_NET any (msg:"monetate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moneyexpert.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mouseflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mowfruit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mpstat.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mr-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mrskincash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mtree.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"musiccounter.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"muwmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mybloglog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mycounter.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mymoneymakingapp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mypagerank.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mystat-in.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mytop-in.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mytrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mzbcdn.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"naj.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"namimedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"navigator.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"navrcholu.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ndparking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nedstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nedstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nedstatbasic.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nedstatpro.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nend.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"neocounter.neoworx-blog-tools.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"neoffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netagent.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netclickstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netcommunities.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"neudesicmediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newads.bangbros.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newbie.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newnudecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newopenx.detik.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newt1.adultworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nexage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nitroclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"novem.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ntv.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nuggad.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"numax.nu-1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.salon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.toronto.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.uniontrib.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.villagevoice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oascentral.businessweek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oascentral.register.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oewa.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oewabox.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"offermatica.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"olivebrandresponse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"omniture.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"onclasrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onclickads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onenetworkdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onestat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onestatfree.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"online-metrix.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onlinecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"open.oneplus.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openad.tf1.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openad.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openads.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx.angelsgroup.org.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx.blindferret.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"opienetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optimost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ordingly.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ota.cartrawler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"outbrain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ovalpigs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;)
alert tcp owneriq.net any $HOME_NET any (msg:"owneriq.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oxcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagefair.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagerank-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagerank-submitter.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagerank-united.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagerank4you.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"parsely.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partner-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partner.pelikan.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partner.topcities.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partnercash.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"passion-4.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pay-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"payserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pbterra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"peacepowder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"peep-auktion.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"peer39.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pennyweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"perfectaudience.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"performancerevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"performancerevenues.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"performancing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pgmediaserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"photographpan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"phpadsnew.new.natuurpark.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"phpmyvisites.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"picadmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pietexture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.adsafeprotected.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.jumptap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.redditmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"playmobileads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"plista.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pop-under.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popflawlessads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popup.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popups.infostart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"porntrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"possibleboats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"postrelease.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"potenza.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"practicetoothpaste.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"praddpro.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prchecker.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"precisioncounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"presetrabbits.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"primaryads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"privatecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pro-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pro.i-doctor.co.kr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"proext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"profero.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"profitrumour.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"projectwonderful.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promo.ulust.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promos.bwin.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promote.pair.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promotion-campaigns.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"propellerads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"proranktracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"protraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"provexia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"provideplant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ps7894.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"psstt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.chez.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.hardware.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.realmedia.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pubdirecte.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pubs.lemonde.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"px.dynamicyield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"qnsr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quaintcan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quarterserver.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"questaffiliates.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quicksandear.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quigo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quisma.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"radar.cedexis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"radarurl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"radiate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rampidads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rank-master.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankchamp.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-charts.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-hits.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-id.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-links.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-liste.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-street.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankingchart.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankingscout.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ratings.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rb1.design.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"re-directme.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reactx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"readgoldfish.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"readserver.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"receptiveink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reduxmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reinvigorate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklama.reflektor.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklame.unwired-i.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklamer.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"relevanz10.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"relmaxtop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"remarketingpixel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"remox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revcontent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revenue.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revenuedirect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revsci.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rlcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rle.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"robotreplay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"roia.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rotabanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtbpop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtbpopd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ru-traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ru4.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rulerabbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"s.adroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sageanalyst.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sail-horizon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"samsungacr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"samsungads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"saysidewalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scambiobanner.aruba.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scanscout.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scarcestream.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scorecardresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scratch2cash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scripte-monster.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scrubsky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scrubswim.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"searchfeast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"searchmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sedoparking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sedotracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sensismediasmart.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"separatesilver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servedby-buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servethis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"serving-sys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexadvertentiesite.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexinyourcity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexlist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sextracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexystat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shakesea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shakytaste.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shareadspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sharepointads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shelterstraw.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sher.index.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shinystat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shiveringsail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shockingswing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"simplisticnose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sinceresofa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sitestat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sixsigmatraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"skimresources.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"skylink.vn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"slickaffiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"slopeaota.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smart4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.180.177 any $HOME_NET any (msg:"smartlook.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.140.40.40 any $HOME_NET any (msg:"smetrics.walgreens.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smowtion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"snakesort.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sneaklevel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sneakystamp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sonobi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spacash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"specially4u.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spectacularsnail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spezialreporte.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spillvacation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spinbox.techtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spinbox.versiontracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sponsors.thoughtsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spotxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spykemediatrack.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spykemediatrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spywarelabs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spywarenuker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spywords.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"squeamishscarecrow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"srwww1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.cliche.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.dealtime.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.dyna.ultraweb.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.webmedia.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.zenon.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat24.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat24.meta.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"static.itrack.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"staticads.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statm.the-adult-company.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.blogger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.merriam-webster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.mirrorfootball.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.multiup.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.olark.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.pusher.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.self.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.townnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.unwired-i.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.x14.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats2.self.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats4all.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statsie.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"steelhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"steelhousemedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stickyadstv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"storesurprise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stormyachiever.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stormyshock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stormysponge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"straightnest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"strivesidewalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"structuresofa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"suavalds.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"succeedscene.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sumo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sumome.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"superclix.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"superficialsink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"supertop.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"surfmusik-adserver.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swan-swan-goose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swissadsolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swordfishdc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sx.trhnt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.insigit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.pusk.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"taboola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tagular.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tailsweep.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tailsweep.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tailsweep.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"takru.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tangerinenet.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targad.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targetingnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targetpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tatsumi-sys.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"teads.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"techclicks.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"teliad.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"terribleturkey.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"textad.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tfag.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"theads.me"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thebugs.ws"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"therichkids.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thirdrespect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thrnt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"throattrees.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tidytrail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tizers.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tlvmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tntclix.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top-casting-termine.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top-site-list.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top.proext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top100-images.rambler.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top20free.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top90.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topbarh.box.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topforall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topgamesites.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topping.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toprebates.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topsafelist.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topsite.lv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topsites.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"totemcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"touchclarity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"touchclarity.natwest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracedesire.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.flexlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.flexlinkspro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.marinsm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.crunchiemedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.gajmp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.internetstores.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackingsoft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tradeadexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tradedoubler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffic.focuusing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficadept.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficbalancerouting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficfactory.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficholder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffichunt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficsecrets.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficspaces.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficstrategies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffictrader.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafic.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"travis.bosscasinos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trekblue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trendmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trhunt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trickycelery.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tritetongue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trix.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trmit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truehits1.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tubemogul.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tvmtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"uarating.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ukbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ultimateclixx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ultramercial.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unknowntray.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unusualtitle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 34.195.240.35 any $HOME_NET any (msg:"userreplay.com"; classtype:trojan-activity; priority:1;)
alert tcp 87.117.202.28 any $HOME_NET any (msg:"userreplay.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"utarget.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valuead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valueclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valueclickmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valuecommerce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"veille-referencement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ventivmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vericlick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vertadnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"veruta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visistat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visit.webhosting.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visitbox.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visual-pagerank.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visualrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voicefive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voicevegetable.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vpon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vrs.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vs.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vungle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wdads.sx.atl.publicus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webads.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webangel.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webcounter.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webcounter.goweb.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webmaster-partnerprogramme24.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webmasterplan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webmasterplan.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"weborama.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webpower.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webreseau.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webseoanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webstats4u.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtrackerplus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtraffic.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtrendslive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wetrack.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whaleads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whenu.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wholesaletraffic.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"widespace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"window.nixnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"witch-counter.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wlmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wmirk.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wonderlandads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wondoads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"worldwide-cash.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ws-gateway.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wtlive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.money4exit.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www1.gto-media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wwwpromoter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"x-traceur.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"x6.yakiuchi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xclicks.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xertive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xg4ken.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xplusone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xtremetop100.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xxxmyself.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yesads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldlab.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldmanager.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldmanager.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldmo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldtraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp yldbt.com any $HOME_NET any (msg:"yldbt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yoggrt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"z5x.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zanox-affiliate.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zanox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zantracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zencudo.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zenkreka.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zeus.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zintext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zv1.november-lax.com"; classtype:trojan-activity; priority:1;)